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REMARKS 

Claims 6, 14, and 22 are rejected under 35 U.S.C. 1 12, second paragraph. Such 
rejection is deemed overcome in view of the clarifications made hereinabove to the 
claims. 

Claims 1-3, 5, 7, 9-11, 13, IS, 17-19, 21 and 23 still stand rejected under 35 USC 
§102 as anticipated by Marsh (U.S. Patent 6,763,462). Applicant respectfully disagrees 
with such rejection, particularly in view of the amendment made hereinabove. 

In response to applicant's earlier amendments and arguments, the Examiner 
continues to rely on the excerpt fix)m Marsh below to meet applicant's claimed technique 
where "(") said e-mail message contains message content having at least a threshold level 
of similarity to message content of said previously generated e-mail messages being sent 
to more than a threshold number of addressees specified within said address book; and 
(iii) said e-mail message contains message content having at least a threshold level of 
similarity to message content of more than a threshold nmnber of said previously 
generated e-mail messages" (see this or similar, but not necessarily identical language in 
each of the independent claims). 

"Referring to FXG, 2, the randoTii numbers may be generated when 
the email application 102 is launched, as shown in blocJc 200. 
Each time an electronic message is transmitted, the virus 
detection utility 104 inspects the outgoing message to identify 
the message's intended recipients. The virus detection utility 
104 may examine e-mail distribution patterns by comparing 
selected e-mail addresses corresponding to the random numbers 
with potential recipients of the outgoing e-mail message at block 
204, If all of the selected e-mail addresses are listed as 
recipients of a pending electronic message at diamond 206, 
possible virus activity may be occurring and a user may be 
notified as shown in block 206. Otherwise, an outgoing electronic 
message may be delivered according to normal operations of the e- 
mail application X02 at block 210. In accordance with another 
embodiment, potential virus activity may be detected by finding a 
specified number of the e-mail addresses corresponding to the 
generated random numbers in the recipient list of an outgoing 
message. For example, a user may be alerted if three (3) of the 
five {S) e-mail addresses associated with the random numbers are 
listed as recipients, m this manner, viruses that attempt to 
spread to other computers rapidly by sending e-mail may be 
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identified by monitoring patterns of e-mail distribution in a 
user's e-mail account. 

A user may be notified pf possible virus activity (block 208) 
through any conventional messaging technique such a3 a pop-up 
warning dialog. A virus warning may include information regarding 
recent e-mail activity such as recipients and message content. 
The virus warning may also give a user options to respond to 
possible virus activity including deleting an outgoing message 
without sending, saving an outgoing message for later 
examination, or disregarding the warning and sending an outgoing 
message." (see col. 3, lines 10-42) 

The Examiner goes on to argue that "Marsh disclosed comparing outgoing 
messages for a certain period of time, two minutes, and if the threshold was reached 
during that time, the message was deleted and not sent. . However, the above 
arguments and the foregoing excerpt, and the remaining Marsh references for that matter, 
remains deficient in that neither address nor suggest a technique for identifying an "e- 
mail message [that] contains message content having at least a threshold level of 
similarity to message content of said previously generated e-mail messages" nor an "e- 
mail message [that] contains message content having at least a threshold level of 
similarity to message content of more than a threshold number of said previously 
generated e-mail messages'' (emphasis added), as claimed. Only applicant teaches and 
claims the application of such a threshold le vel nf similarity 

It is noted that the system of Marsh would be useless if malware sought to 
disguise itself by altering the message content of the e-mail messages, since Marsh 
merely addresses viruses that "replicate" e-mails. Note col. 3^ line 46 from Marsh. To 
this end, simply nowhere in the prior art is there such a specifically claimed technique for 
providing protection against malware which seeks to disguise itself, using a threshold 
level of similarity, as specifically claimed 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co, Of California, 814 R2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
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Co.m F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed, Cir. 1989). The elements must be 
arranged as required by the claim. 

This criteria has sunply not been met by the Marsh reference. Nevertheless, 
despite SMch paramount deficiencies and in the spirit of expediting the prosecution of the 
present application, applicant has included the subject matter below in each of the 
independent claims. 

said e-mail message contains message content having at least a 
threshold level of similarity to non-identical m essage content of said previously 
generated e-mail messages being sent to more than a threshold number of 
addressees specified within said address book; and 

(iii) said e-mail message contains message content having at least a 
threshold level of similarity to non-identical m essage content of more than a 
threshold number of said previously generated e-mail messages" (emphasis added 
- note page 4, first paragraph in the summary section of the originally-filed 
application). 

Thus, it is now fiirther emphasized that applicant teaches and claims a threshold 
level of similarity that is capable of being used to identify instances where an e-mail 
message contains message content having at least a threshold level of similarity to noa- 
identicaLm essage content. This is of particular importance in order to provide protection 
against malware wliich seeks to disguise itself. 

A notice of allowance or a specific prior art showing of all of applicant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 
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In the event a telephone conversation would expedite the prosecution of this 
^plication, the Examiner may reach lie undersigned at (408) 505-5100, The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P462/01. 059.01). 



P.O. Box 721 120 

San Jose, CA 95172-1120 

408-505-5100 
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